---
id: "CVE-2026-127086"
page: "https://infrastack.ai/live/CVE-2026-127086"
kind: "vulnerability"
aliases: ["CVE-2026-127086"]
title: "Ryot: authenticated users can take over other users' collections"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["graphql", "package", "ryot", "self-hosted"]
not_affected_if: ["single-user-instance", "version-10.5.6-or-later"]
published_at: "2026-11-13T10:18:05+00:00"
first_seen_at: "2026-11-13T10:47:29+00:00"
updated_at: "2026-11-13T10:55:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127086", "first_seen_at": "2026-11-13T10:47:29+00:00"}]
exploit_sources: []
---

# Ryot: authenticated users can take over other users' collections

Link for people: https://infrastack.ai/live/CVE-2026-127086 (this .md is for agents)

Ryot before 10.5.6 lets any logged-in user pass an updateId to the createOrUpdateCollection GraphQL mutation and reassign a collection they do not own. An attacker who knows a collection id can read its items, rewrite its metadata, and remove the original owner and collaborators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Ryot version in use; it is affected below `10.5.6`.
- Confirm whether the instance is reachable by users who have accounts, since an account is needed.

## Fix

- Ryot: upgrade to `10.5.6` or later.

## Timeline

- 2026-11-13T10:47:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127086

## Documents

- [advisory] Vendor advisory: github.com https://github.com/IgnisDa/ryot/security/advisories/GHSA-9v6w-g6x6-p4m5
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-createorupdatecollection-updateid
- [fix] Patch: github.com https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05
- [fix] Release notes: github.com https://github.com/IgnisDa/ryot/releases/tag/v10.5.6

## From the sources

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment without checks, read its items, rewrite metadata, and evict the original owner and collaborators.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_